1. Field of the Invention
This invention relates to the technical field of initialization of a chip card and in particular to the compilation and processing of a record that is read into the chip card in an initialization step.
2. Description of the Background Art
Chip cards are well known in many embodiments. They are used for example for access control or in payment transactions and normally have a semiconductor chip with a microcontroller and at least one memory. Besides the usual designs in checkcard size or as small card modules (e.g. SIMs—subscriber identity modules in mobile phones), chip cards are also produced in other designs (e.g. as key pendants or rings). All these embodiments are to be referred to as “chip cards” in the present text.
During production of chip cards, initialization is the method step by which, after completion and successful testing of the chip card hardware, those programs and/or data are imported into the chip card that are identical for a relatively large number of chip cards. The subsequent step of loading personal, individual data is referred to as personalization.
The separation of these two steps is effected for reasons of production engineering to minimize the quantity of data to be transferred individually into individual chip cards. In some cases of application, so-called post-initialization is inserted between the steps of initialization and personalization, by which additional programs and/or data are written into a relatively small number of chip cards. An overview of these production steps and their delimitation is found in Chapter 10.4 (pages 584 to 592) of the book “Handbuch der Chipkarten” by Wolfgang Rankl and Wolfgang Effing, 3rd edition 1999.
According to an at least internal prior art of the applicant, chip cards for the GSM mobile phone system contain a 32-byte release key in a mask-programmed ROM of the chip card. To start the initialization process a data value matching the release key must be transferred to the chip card with a suitable command (e.g. VERIFY INITIALIZATION KEY). The transferred value is compared with the release key stored in the chip card ROM. In case of a match, access is released to an EEPROM of the chip card and all chip card commands required for initialization.
Subsequent loading of initialization data into the chip card can be done either openly or encrypted with a load key. Encrypted loading ensures that the privacy of the encrypted initialization data is retained in case of unauthorized access.
However, this system still involves the problem that the release key must be known to the authority performing initialization. It is increasingly required that not only the chip card manufacturer itself but also external partners (e.g. mobile phone network operators) initialize chip cards on their own. In this case there is a danger of the release key being spied out during transfer to the external partner or when it is read into the chip card, or of the external partner not keeping the release key strictly secret.
If the release key were made accessible to unauthorized persons a whole chip card product line might possibly be compromised, because the release key permits access to diverse basic chip card functions which can in turn be used for spying out the chip card's hardware and software. For example, if an unauthorized third person knows the release key he can load his own program code into the chip card and thus spy out the code already located in the mask-programmed ROM.
German laid-open print DE 196 33 466 A1 discloses a method for post-initialization of chip cards. This method, like the procedure described above in connection with initialization, uses a key to release certain commands of the chip card operating system.
German laid-open print DE 199 02 722 A1 shows a cryptographic method for exchanging a secret initial value between a processing station and a chip card, which avoids transfer of the initial value in plaintext.
European laid-open print EP-A 0 955 603 discloses a method by which a private key of the card manufacturer is sent to the initializing authority in encrypted form for reading in initialization data. In the chip card the decrypted private key is compared with the stored private key and if there is a match the initialization with the initialization data is allowed.